From ac0f38069124b78e6ea3b502c8a6b020b8264fe7 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 21 Mar 2025 22:30:38 +0000 Subject: [PATCH] Publish Advisories GHSA-mjq8-gg9x-87gr GHSA-528q-4pgm-wvg2 --- .../GHSA-mjq8-gg9x-87gr.json | 31 +++++-- .../GHSA-528q-4pgm-wvg2.json | 82 +++++++++++++++++++ 2 files changed, 108 insertions(+), 5 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/03/GHSA-mjq8-gg9x-87gr/GHSA-mjq8-gg9x-87gr.json (67%) create mode 100644 advisories/github-reviewed/2025/03/GHSA-528q-4pgm-wvg2/GHSA-528q-4pgm-wvg2.json diff --git a/advisories/unreviewed/2024/03/GHSA-mjq8-gg9x-87gr/GHSA-mjq8-gg9x-87gr.json b/advisories/github-reviewed/2024/03/GHSA-mjq8-gg9x-87gr/GHSA-mjq8-gg9x-87gr.json similarity index 67% rename from advisories/unreviewed/2024/03/GHSA-mjq8-gg9x-87gr/GHSA-mjq8-gg9x-87gr.json rename to advisories/github-reviewed/2024/03/GHSA-mjq8-gg9x-87gr/GHSA-mjq8-gg9x-87gr.json index 09bd0e626b6..6432f1fc1f5 100644 --- a/advisories/unreviewed/2024/03/GHSA-mjq8-gg9x-87gr/GHSA-mjq8-gg9x-87gr.json +++ b/advisories/github-reviewed/2024/03/GHSA-mjq8-gg9x-87gr/GHSA-mjq8-gg9x-87gr.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-mjq8-gg9x-87gr", - "modified": "2025-03-20T21:31:39Z", + "modified": "2025-03-21T22:28:56Z", "published": "2024-03-18T09:30:31Z", "aliases": [ "CVE-2024-28128" ], + "summary": "FitNesse Cross-site Scripting vulnerability", "details": "Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.", "severity": [ { @@ -13,14 +14,34 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.fitnesse:fitnesse" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "20220319" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28128" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/unclebob/fitnesse" }, { @@ -41,8 +62,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-21T22:28:56Z", "nvd_published_at": "2024-03-18T08:15:06Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-528q-4pgm-wvg2/GHSA-528q-4pgm-wvg2.json b/advisories/github-reviewed/2025/03/GHSA-528q-4pgm-wvg2/GHSA-528q-4pgm-wvg2.json new file mode 100644 index 00000000000..92310806feb --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-528q-4pgm-wvg2/GHSA-528q-4pgm-wvg2.json @@ -0,0 +1,82 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-528q-4pgm-wvg2", + "modified": "2025-03-21T22:29:47Z", + "published": "2025-03-21T22:29:47Z", + "aliases": [], + "summary": "Reflected XSS in go-httpbin due to unrestricted client control over Content-Type", + "details": "### Description\n\nThe go-httpbin framework is vulnerable to XSS as the user can control the `Response Content-Type` from GET parameter. This allows attacker to execute cross site scripts in victims browser.\n\n### Affected URLs:\n- `/response-headers?Content-Type=text/html&xss=%3Cimg/src/onerror=alert(%27xss%27)%3E`\n- `/base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html`\n- `/base64/decode/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html`\n\n### Steps to reproduce:\n1. Visit one of the above mentioned URLs.\n2. XSS window will popup\n\n### Suggested fix\n- Allow Only Safe Content-Type Values Or give users option to define whitelisted Content-Type headers\n\n\n### Criticality\nThe following can be major impacts of the issue:\n* Access to victim's sensitive Personal Identifiable Information.\n* Access to CSRF token\n* Cookie injection\n* Phishing\n* And any other thing Javascript can perform", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mccutchen/go-httpbin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.18.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mccutchen/go-httpbin/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.18.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-528q-4pgm-wvg2" + }, + { + "type": "WEB", + "url": "https://github.com/mccutchen/go-httpbin/commit/0decfd1a2e88d85ca6bfb8a92421653f647cbc04" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mccutchen/go-httpbin" + }, + { + "type": "WEB", + "url": "https://github.com/mccutchen/go-httpbin/releases/tag/v2.18.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-03-21T22:29:47Z", + "nvd_published_at": null + } +} \ No newline at end of file